DBS-C01 Database Security Practice Question
A company is using Amazon RDS for MySQL and needs to encrypt data at rest for an existing DB instance. Which approach meets this requirement with minimal downtime?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.
To encrypt an existing unencrypted RDS MySQL DB instance, you cannot directly modify the instance. The standard approach is to take a snapshot, create an encrypted copy of the snapshot, and then restore that encrypted snapshot to a new DB instance. This method typically involves minimal downtime compared to other options. Option A correctly describes this process. Option B is incorrect because encryption cannot be enabled directly on an existing instance. Option C is incorrect because the AWS CLI modify-db-instance command does not support enabling encryption on an existing instance; the --storage-encrypted flag only applies to new instances. Option D is incorrect because creating a read replica with encryption does not encrypt the primary instance; you would still need to perform a snapshot restore for the primary's encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.
Why this is correct
This is the standard method to encrypt an existing RDS instance with minimal downtime.
- ✗
Enable encryption directly on the existing DB instance by modifying it.
Why it's wrong here
RDS does not allow enabling encryption directly on an existing unencrypted instance.
- ✗
Use the AWS CLI command modify-db-instance with the --storage-encrypted flag.
Why it's wrong here
The modify-db-instance command does not support enabling encryption on an existing instance.
- ✗
Create a read replica of the DB instance with encryption enabled, then promote it.
Why it's wrong here
Read replicas inherit encryption from the source; you cannot enable encryption on a replica if the source is unencrypted.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to encrypt data at rest for an existing Amazon RDS for MySQL DB instance. The database is currently unencrypted. What is the most efficient way to enable encryption?
easy- A.Enable encryption on the existing DB instance by modifying the parameter group.
- ✓ B.Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.
- C.Use AWS KMS to automatically encrypt the DB instance.
- D.Modify the DB instance and enable encryption from the RDS console.
Why B: RDS does not support enabling encryption on an existing unencrypted DB instance directly. You must create a snapshot, copy it with encryption enabled, and restore from that encrypted snapshot. Option A is incorrect because you cannot modify the DB instance to enable encryption. Option C is incorrect because AWS KMS does not automatically encrypt the DB instance. Option D is incorrect because you cannot directly configure encryption on the existing instance.
Variation 2. A company wants to encrypt data at rest for an existing Amazon RDS for Oracle DB instance. The database is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?
easy- A.Create an encrypted read replica and promote it to a standalone instance.
- B.Modify the DB instance and enable encryption using the RDS console.
- ✓ C.Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.
- D.Enable encryption directly on the existing DB instance by modifying the DB instance settings.
Why C: You cannot directly enable encryption on an existing unencrypted Amazon RDS instance. The correct process is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and then restore the encrypted snapshot to a new DB instance. You then redirect traffic to the new instance. Option A is incorrect because creating a read replica does not encrypt the master instance, and the replica can only be encrypted if the master is already encrypted. Option B is incorrect because you cannot modify an existing DB instance to enable encryption through the RDS console. Option D is incorrect because enabling encryption directly on the existing DB instance is not supported.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.